announce  

Messages by Thread

• CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder Emmanuel Lécharny via announce
• CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default Jens Geyer via announce
• [ANNOUNCE] Apache Lucene 10.6.0 released Houston Putman via announce
• CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup() Yash Mayya
• [ANNOUNCE] Apache Solr 10.1.0 released Andrzej Białecki
• [ANNOUNCE] Apache Teaclave™ TrustZone SDK 0.10.0 Released Zehui Chen
• [ANNOUNCE] Apache Maka 0.2.2 (incubating) released Yuhan Lei
• CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API Terence Monteiro
• CVE-2026-65874: Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints Terence Monteiro
• [ANNOUNCE] Apache DataSketches Rust 0.6.0 released tison
• [ANNOUNCE] Apache Wicket 8.20.0 marks the end of Wicket 8 Martijn Dashorst
• [ANNOUNCE] Apache Wicket 9.25.0 marks the end of Wicket 9 Martijn Dashorst
• [ANNOUNCE] Fineract 1.16.1 Release meonkeys
• [ANNOUNCE] Apache Tika 4.2.0 released Tim Allison
• [ANN] Apache Tomcat Native 1.3.10 released Mark Thomas
• [ANN] Apache Tomcat Native 2.0.17 released Mark Thomas
• [ANNOUNCE] Apache Pinot 1.6.0 released Xiang Fu
• CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured Manikumar
• [ANNOUNCE] Apache MINA SSHD 2.20.1 released Thomas Wolf
• [ANNOUNCE] Apache MINA SSHD 3.0.0-M7 released Thomas Wolf
• CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash Andrew Stitcher
• [ANNOUNCE] Apache Qpid Proton 0.41.1 released Andrew Stitcher
• CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors. Andrew Stitcher
• CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames Andrew Stitcher
• CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read Andrew Stitcher
• CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches Manikumar
• CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default Manikumar
• CVE-2026-83525: Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request. Manikumar
• CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint Manikumar
• [ANNOUNCE] Apache Axis2/Java 2.0.2 released robertlazarski
• CVE-2026-112375: Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs Manikumar
• CVE-2026-111108: Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers Manikumar
• CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions Manikumar
• CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation Manikumar
• CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation Manikumar
• CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service Manikumar
• CVE-2026-111115: Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing Manikumar
• [ANNOUNCE] Apache ActiveMQ 6.4.0 has been released! Jean-Baptiste Onofré
• [ANNOUNCE] Apache ActiveMQ 6.3.3 and 5.19.12 have been released! Jean-Baptiste Onofré
• [ANNOUNCE] Apache Kafka 4.3.2 Jiunn-Yang Huang
• [ANNOUNCE] Apache Arrow ADBC 25 Released David Li
• CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host Hussein Awala
• [ANNOUNCE] Apache Pulsar 5.0.1 released Lari Hotari
• [ANNOUNCEMENT] HttpComponents Client 5.7-beta1 Released Oleg Kalnichevski
• [ANNOUNCE] Apache Asyncband (Incubating) 0.7.4 released iqwqi
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-20 are released Hussein Awala
• [ANNOUNCE] Apache POI 6.0.0 release PJ Fanning
• CVE-2026-115721: Apache Vysper: Unbounded allocation Thomas Wolf
• CVE-2026-115748: Apache Vysper: Authorization bypass Thomas Wolf
• CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions Andrea Cosentino
• CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry Andrea Cosentino
• CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory Andrea Cosentino
• CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047) Andrea Cosentino
• CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache Andrea Cosentino
• CVE-2026-90885: Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved Andrea Cosentino
• CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• [ANNOUNCE] Apache Camel 4.22.2 (LTS) Released Gregor Zurowski
• [ANNOUNCE] Release Apache Paimon Terraform 0.1.0 Jiajia Li
• CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing Piotr Karwasz
• CVE-2026-105869: Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role Lari Hotari
• CVE-2026-105926: Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands Lari Hotari
• CVE-2026-105933: Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization Lari Hotari
• CVE-2026-105944: Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life Lari Hotari
• CVE-2026-105930: Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download Lari Hotari
• CVE-2026-105927: Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission Lari Hotari
• CVE-2026-105936: Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint Lari Hotari
• CVE-2026-105932: Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints Lari Hotari
• CVE-2026-105934: Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic Lari Hotari
• CVE-2026-105937: Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data Lari Hotari
• CVE-2026-105942: Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation Lari Hotari
• CVE-2026-105935: Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission Lari Hotari
• CVE-2026-105931: Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants Lari Hotari
• CVE-2026-105938: Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all Lari Hotari
• CVE-2026-105945: Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage Lari Hotari
• CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation Haonan Hou
• CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC Haonan Hou
• CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface Haonan Hou
• CVE-2026-41114: Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver Haonan Hou
• [ANNOUNCE] Apache Jackrabbit Oak 1.22.25 released Julian Reschke
• Apache bRPC security advisory: 35 vulnerabilities fixed in 1.18.0 Weibing Wang
• [ANNOUNCE] Apache BookKeeper 4.18.2 released Matteo Merli
• CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases Jan Lehnardt
• [SECURITY] CVE-2026-101356 Apache Tomcat - HTTP/2 request/response mix-up after error during async processing Mark Thomas
• CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely Jan Lehnardt
• [ANNOUNCE] Apache Casbin SQLx Adapter (Incubating) 1.9.0 emryzhang
• [SECURITY] CVE-2026-74049 Apache Tomcat - Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) Mark Thomas
• [SECURITY] CVE-2026-74048 Apache Tomcat - OpenSSL-FFM FIPS failure does not prevent start-up Mark Thomas
• [SECURITY] CVE-2026-103119 Apache Tomcat - AJP response mix-up Mark Thomas
• [SECURITY] CVE-2026-101296 Apache Tomcat - JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms Mark Thomas
• [SECURITY] CVE-2026-93446 Apache Tomcat - Possible TLS 1.3 connection failures Mark Thomas
• [SECURITY] CVE-2026-88041 Apache Tomcat - HTTP/2 trailer header cross-contamination Mark Thomas
• [SECURITY] CVE-2026-80353 Apache Tomcat - TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector Mark Thomas
• CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values Jan Lehnardt
• CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs Jan Lehnardt
• CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user Jan Lehnardt
• CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session Jan Lehnardt
• CVE-2026-108087: Apache Cocoon: SQL Injection Arnout Engelen
• CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure Arnout Engelen
• CVE-2026-108089: Apache Cocoon: Unauthenticated access to diagnostic interfaces Arnout Engelen
• CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning Arnout Engelen
• [ANNOUNCE] Apache Jackrabbit Oak 2.8.0 released Julian Reschke
• CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation Adam Reeve
• [ANNOUNCE] Apache Commons JEXL 3.7.1 Gary Gregory
• CVE-2026-86467: Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account Jarek Potiuk
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-17 are released Jarek Potiuk
• [ANNOUNCE] Apache Arrow 26.0.0 released Raúl Cumplido
• CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution Andrea Cosentino
• [ANNOUNCE] OpenDAL 0.59.5-rc.2 released xuanwo
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-14 are released Jarek Potiuk
• CVE-2026-85243: Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure Andrea Cosentino
• CVE-2026-85245: Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target Andrea Cosentino
• CVE-2026-108743: Apache Kylin: spark job OS command injection Li Yang
• CVE-2026-85249: Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata Andrea Cosentino
• CVE-2026-85251: Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets Andrea Cosentino
• CVE-2026-80312: Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors Andrea Cosentino
• CVE-2026-83531: Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages Andrea Cosentino
• [ANNOUNCE] Apache Johnzon 1.3.1 Markus Jung
• CVE-2026-71253: Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON Markus Jung
• CVE-2026-85300: Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions Andrea Cosentino
• CVE-2026-85254: Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing Andrea Cosentino
• CVE-2026-85313: Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set Andrea Cosentino
• CVE-2026-85314: Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) Andrea Cosentino
• CVE-2026-85317: Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache Andrea Cosentino
• CVE-2026-85260: Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default Andrea Cosentino
• CVE-2026-85257: Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• CVE-2026-85296: Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State Andrea Cosentino
• CVE-2026-78165: Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads Andrea Cosentino
• CVE-2026-85246: Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• CVE-2026-84181: Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse Andrea Cosentino
• CVE-2026-85248: Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance Andrea Cosentino
• CVE-2026-85247: Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore Andrea Cosentino
• CVE-2026-85301: Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim Andrea Cosentino
• CVE-2026-85250: Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option Andrea Cosentino
• CVE-2026-85312: Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header Andrea Cosentino
• CVE-2026-91858: Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present Andrea Cosentino
• CVE-2026-85315: Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• CVE-2026-79986: Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• CVE-2026-85316: Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching Andrea Cosentino
• CVE-2026-88901: Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default Andrea Cosentino
• CVE-2026-80343: Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching Andrea Cosentino
• CVE-2026-79983: Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• CVE-2026-79984: Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• CVE-2026-84178: Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow Andrea Cosentino
• CVE-2026-78164: Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers Andrea Cosentino
• CVE-2026-71569: Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name Andrea Cosentino
• CVE-2026-78163: Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure Andrea Cosentino
• CVE-2026-78162: Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) Andrea Cosentino
• CVE-2026-79985: Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside Andrea Cosentino
• CVE-2026-80344: Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address Andrea Cosentino
• CVE-2026-84176: Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection Andrea Cosentino
• CVE-2026-84180: Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication Enxin Xie
• CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content Enxin Xie
• CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content Enxin Xie
• CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions Enxin Xie
• CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata Enxin Xie
• CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles Enxin Xie
• CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles Enxin Xie
• CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation Enxin Xie
• CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover Enxin Xie
• CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions Enxin Xie
• CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup Enxin Xie
• CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content Enxin Xie
• CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension Enxin Xie
• CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation Li Yang
• CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass Li Yang
• CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF Li Yang
• CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization Li Yang
• CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection Li Yang
• CVE-2026-108766: Apache Kylin: missing JDBC-config authorization Li Yang
• CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue Li Yang
• CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement Li Yang
• CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion Li Yang
• CVE-2026-108833: Apache Kylin: default startup profile miss security settings Li Yang
• CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard Li Yang
• CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass Li Yang
• CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup Li Yang
• CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env Li Yang
• CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController Li Yang
• CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints Li Yang
• CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) Li Yang
• CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure Li Yang
• CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump Li Yang
• CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization Li Yang
• CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default Jarek Potiuk
  • CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default Jarek Potiuk
• CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default Jarek Potiuk
• CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token Jarek Potiuk
• CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read Jarek Potiuk
• [ANNOUNCE] Apache Camel 4.23.0 Released Gregor Zurowski
• [ANNOUNCE] Apache Pekko HTTP 1.4.2 released PJ Fanning
• [ANNOUNCE] Apache SeaTunnel 3.0.0 Released — A Major Milestone Release lidongdai
• [ANNOUNCE] Apache SedonaDB 0.5.0 released Dewey Dunnington
• [ANNOUNCEMENT] HttpComponents Core 5.5-beta4 released Oleg Kalnichevski
• [ANNOUNCE] Apache SIS 1.7 Release Martin Desruisseaux
• [ANNOUNCE] Apache Tika 3.3.3 released Tim Allison
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-10-06 are released Jarek Potiuk
• CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding Shuxin Pan
• [ANNOUNCE] Apache Pulsar Helm Chart version 4.8.0 Released Lari Hotari
• Subject: [ANNOUNCE] Release Apache Paimon Rust 0.4.0 hope

• Earlier messages